_wp_translate_postdata() should use current_user_can( $ptype->cap->edit_post, $post_id )

[danielbachhuber]

Similar to #22415, _wp_translate_postdata() should use current_user_can( $ptype->cap->edit_post, $post_id ) here:

$ptype = get_post_type_object( $post_data['post_type'] );
	if ( isset($post_data['user_ID']) && ($post_data['post_author'] != $post_data['user_ID']) ) {
		if ( !current_user_can( $ptype->cap->edit_others_posts ) ) {

I think this is problematic too:

if ( $previous_status != 'publish' || !current_user_can( 'edit_post', $post_id ) )
			$post_data['post_status'] = 'pending';

Switching to current_user_can( $ptype->cap->edit_post, $post_id ) would mean that the context could be appropriately filtered.

I imagine this is in place for _wp_translate_postdata( false ), as in — when it is not used for an update.

wp_write_post() uses this, but this code is actually dead now and has been since auto-drafts are introduced, because edit_post() gets called right before it. For more on removing wp_write_post() and making this code more sane, see #21963.

If $update, we should be able to make the more informed capability checks you are proposing.

Started some basic tests for this code in ​[UT1147]

@danielbachhuber it would be really useful if you could help write some tests which show the issues you are having to add to the above tests.

Patch to make the first cap check post_ID aware

That patch shows that my tests are broken too, need to update them to create real posts for the update = true tests ;)

Tests fixed in ​[UT1150]

In 22769:

Posting: Improve the capability checking _wp_translate_postdata() when updating posts.

• Use the specific post_type's 'edit_post' cap
• Pass the ID of the post being edited.

Fixes #22417

Chatted about this with westi in IRC. A few points:

• The second part of this bug report can be answered by (and further addressed in) #22415.

• [22769] looks good, but after it landed, I noticed that 'edit_post' could get away with being outside of the post_author == user_ID block, instead letting the meta capability handle that part. Of course, that check may still be necessary for $update = false (which I'll aim to eliminate in 3.6). So, re-opening for review.

Back to westi.

In 22950:

Add a create_posts check to _wp_translate_postdata(). Move the edit_post check to the top of the function.

Props nacin
fixes #22417